Java7 Refusing to trust certificate in trust store

Solution 1:

I actually had a somewhat similar issue, where a Tomcat application would trust the ca cert in the truststore when using Java 1.6 and reject it with java 1.7. After adding keyUsage to my ca certificate it works (after reading a bug report, JDK-7018897 : CertPath validation cannot handle self-signed cert with bad KeyUsage).

What I have done (Ubuntu 12.04 x64):

1. Edit /etc/ssl/openssl.cnf and uncomment keyUsage line in v3_ca section.

2. Generate new ca cert from old one with keyUsage included using the command:

   openssl x509 -in oldca.pem -clrext -signkey oldca.key -extfile /etc/ssl/openssl.cnf -extensions v3_ca -out newca.pem
   

3. Delete old CA key from truststore and insert the new one.